Deck 8: Securing Information Systems

Question 1

________ refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards.

A) "Legacy systems"
B) "SSID standards"
C) "Vulnerabilities"
D) "Controls"
E) "Authentication"

Answer 1

D

Question 2

Which of the following is not an example of a computer used as an instrument of crime?

A) Theft of trade secrets
B) Intentionally attempting to intercept electronic communication
C) Unauthorized copying of software
D) Breaching the confidentiality of protected computerized data
E) Illegally accessing stored electronic communications

Answer 2

D

Question 3

Which of the following statements about botnets is not true?

A) Eighty percent of the world's malware is delivered by botnets.
B) Botnets are often used to perpetrate DDoS attacks.
C) Ninety percent of the world's spam is delivered by botnets.
D) Botnets are often used for click fraud.
E) It is not possible to make a smartphone part of a botnet.

Answer 3

E

Question 4

________ refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems.

A) "Security"
B) "Controls"
C) "Benchmarking"
D) "Algorithms"
E) "Authentication"

Question 5

Most computer viruses deliver a:

A) worm.
B) Trojan horse.
C) driveby download.
D) keylogger.
E) payload.

Question 6

A salesperson clicks repeatedly on the online ads of a competitor's in order to drive the competitor's advertising costs up. This is an example of:

A) phishing.
B) pharming.
C) spoofing.
D) click fraud.
E) sniffing.

Question 7

Which of the following is not an example of a computer used as a target of crime?

A) Knowingly accessing a protected computer to commit fraud
B) Accessing a computer system without authority
C) Illegally accessing stored electronic communication
D) Threatening to cause damage to a protected computer
E) Breaching the confidentiality of protected computerized data

Question 8

Which of the following statements about wireless security is not true?

A) SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs.
B) Radio frequency bands are easy to scan.
C) An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network.
D) Intruders can force a user's NIC to associate with a rogue access point.
E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers.

Question 9

An independent computer program that copies itself from one computer to another over a network is called a:

A) worm.
B) Trojan horse.
C) bug.
D) pest.
E) sniffer.

Question 10

An example of phishing is:

A) flooding a web server with thousands of requests for service.
B) setting up a fake medical website that asks users for confidential information.
C) a program that records the keystrokes on a computer.
D) sending bulk email that asks for financial aid under a false pretext.
E) malware that displays annoying pop-up messages.

Question 11

Redirecting a web link to a different address is a form of:

A) snooping.
B) spoofing.
C) sniffing.
D) war driving.
E) SQL injection attack.

Question 12

Conficker (also known as Downadup or Downup) is an example of which of the following?

A) SQL injection attack
B) Browser parasite
C) Worm
D) Ransomware
E) Script virus

Question 13

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack.

A) DDoS
B) DoS
C) SQL injection
D) phishing
E) ransomware

Question 14

Specific security challenges that threaten clients in a client/server environment include:

A) tapping, sniffing, message alteration, and radiation.
B) hacking, vandalism, and denial of service attacks.
C) theft, copying, alteration of data, and hardware or software failure.
D) unauthorized access, errors, and spyware.
E) vandalism, message alteration, and errors.

Question 15

Specific security challenges that threaten corporate servers in a client/server environment include:

A) tapping, sniffing, message alteration, and radiation.
B) hacking, vandalism, and denial of service attacks.
C) theft, copying, alteration of data, and hardware or software failure.
D) unauthorized access, errors, and spyware.
E) vandalism, message alteration, and errors.

Question 16

CryptoLocker is an example of which of the following?

A) Trojan Horse
B) SQL injection attack
C) Sniffer
D) Evil twin
E) Ransomware

Question 17

A keylogger is a type of:

A) worm.
B) Trojan horse.
C) virus.
D) spyware.
E) SQL injection attack.

Question 18

Which of the following statements about Internet security is not true?

A) The use of P2P networks can expose a corporate computer to outsiders.
B) A corporate network without access to the Internet is more secure than one that provides access.
C) VoIP is more secure than the switched voice network.
D) Instant messaging can provide hackers access to an otherwise secure network.
E) Most VoIP traffic is not encrypted.

Question 19

Phishing is a form of:

A) spoofing.
B) logging.
C) sniffing.
D) war driving.
E) ransomware.

Question 20

Specific security challenges that threaten the communications lines in a client/server environment include:

A) tapping, sniffing, message alteration, and radiation.
B) hacking, vandalism, and denial of service attacks.
C) theft, copying, alteration of data, and hardware or software failure.
D) unauthorized access, errors, and spyware.
E) errors, vandalism, and malware.

Question 21

________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.

A) Identity theft
B) Spoofing
C) Social engineering
D) Evil twins
E) Cybervandalism

Question 22

A foreign country attempting to access government networks in order to disable a national power grid would be an example of:

A) phishing.
B) denial-of-service attacks.
C) cyberwarfare.
D) ransomware.
E) injection attack.

Question 23

According to Ponemon Institute's 2014 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for companies in the United States was approximately:

A) $1.27 million.
B) $12.7 million.
C) $127 million.
D) $1.27 billion.
E) $12.7 billion.

Question 24

According to the 2015 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2014?

A) $1.6 million
B) $16 million
C) $160 million
D) $1.6 billion
E) $16 billion

Question 25

________ identify the access points in a Wi-Fi network.

A) NICs
B) Mac addresses
C) URLs
D) SSIDs
E) CAs

Question 26

All of the following countries are popular sources of malware attacks except:

A) the Netherlands.
B) the United Kingdom.
C) the United States.
D) Germany.
E) Mexico.

Question 27

Which of the following is the single greatest cause of network security breaches?

A) Viruses
B) User lack of knowledge
C) Trojan horses
D) Cyberwarfare
E) Bugs

Question 28

According to IT security experts, mobile devices pose greater security risks than larger computers.

Question 29

Which of the following is a type of ambient data?

A) Computer log containing recent system errors
B) A file deleted from a hard disk
C) A file that contains an application's user settings
D) A set of raw data from an environmental sensor
E) An email file

Question 30

Pharming involves:

A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser.
B) pretending to be a legitimate business's representative in order to garner information about a security system.
C) setting up fake websites to ask users for confidential information.
D) using emails for threats or harassment.
E) malware that displays annoying pop-up messages.

Question 31

Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime?

A) Computer Fraud and Abuse Act
B) Economic Espionage Act
C) Electronic Communications Privacy Act
D) Data Security and Breach Notification Act
E) National Information Infrastructure Protection Act

Question 32

All of the following have contributed to an increase in software flaws except:

A) the growing complexity of software programs.
B) the growing size of software programs.
C) demands for timely delivery to markets.
D) the inability to fully test programs.
E) the increase in malicious intruders seeking system access.

Question 33

Evil twins are:

A) Trojan horses that appear to the user to be a legitimate commercial software application.
B) email messages that mimic the email messages of a legitimate business.
C) fraudulent websites that mimic a legitimate business's website.
D) bogus wireless network access points that look legitimate to users.
E) viruses that affect smartphones.

Question 34

Wireless networks are more difficult to penetrate because radio frequency bands are hard to scan.

Question 35

A practice in which eavesdroppers drive by buildings or park outside and try to intercept wireless network traffic is referred to as:

A) war driving.
B) sniffing.
C) cybervandalism.
D) driveby tapping.
E) driveby downloading.

Question 36

Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called:

A) sniffing.
B) social engineering.
C) phishing.
D) pharming.
E) click fraud.

Question 37

Smartphones have the same security flaws as other Internet-connected devices.

Question 38

Computer worms spread much more rapidly than computer viruses.

Question 39

The term cracker is used to identify a hacker whose specialty is breaking open security systems.

Question 40

Viruses cannot be spread through email.

Question 41

The HIPAA Act of 1996:

A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) requires that companies retain electronic records for at least 10 years.

Question 42

Hackers and their companion viruses are an increasing problem, especially on the Internet. What are the most important measurers for a firm to take to protect itself from this? Is full protection feasible? Why or why not?

Question 43

One form of spoofing involves forging the return address on an email so that the email message appears to come from someone other than the sender.

Question 44

Sniffers enable hackers to steal proprietary information from anywhere on a network, including email messages, company files, and confidential reports.

Question 45

Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.

Question 46

Explain how an SQL injection attack works and what types of systems are vulnerable to this type of attack.

Question 47

Zeus is an example of a Trojan horse.

Question 48

Three major concerns of system builders and users are disaster, security, and human error. Of the three, which do you think is most difficult to deal with? Why?

Question 49

What are the security challenges faced by the use of wireless networks?

Question 50

The most common type of electronic evidence is:

A) voice-mail.
B) spreadsheets.
C) instant messages.
D) email.
E) e-commerce transactions over the Internet.

Question 51

Define computer forensics and describe the types of problems it is designed to address.

Question 52

DoS attacks are used to destroy information and access restricted areas of a company's information system.

Question 53

The Sarbanes-Oxley Act:

A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) requires that companies retain electronic records for at least 10 years.

Question 54

Your company, an online clothing store, has calculated that a loss of Internet connectivity for 5 hours results in a potential loss of $1,000 to $2,000 and that there is a 50% chance of this occurring. What is the annual expected loss from this exposure?

A) $750
B) $1,000
C) $1,500
D) $2,000
E) $3,000

Question 55

Computer forensics tasks include all of the following except:

A) presenting collected evidence in a court of law.
B) securely storing recovered electronic data.
C) collecting physical evidence on the computer.
D) finding significant information in a large volume of electronic data.
E) recovering data from computers while preserving evidential integrity.

Question 56

The Gramm-Leach-Bliley Act:

A) requires financial institutions to ensure the security of customer data.
B) specifies best practices in information systems security and control.
C) imposes responsibility on companies and management to safeguard the accuracy of financial information.
D) outlines medical security and privacy rules.
E) requires that companies retain electronic records for at least 10 years.

Question 57

Which of the following sued BJ's Wholesale Club for allowing hackers to access its systems and steal credit and debit card data for fraudulent purchases?

A) The U.S. Justice Department
B) The U.S. Food and Drug Administration
C) The U.S. Federal Trade Commission
D) The Federal Bureau of Investigation
E) The U.S. Securities and Exchange Commission

Question 58

Why is software quality important to security? What specific steps can an organization take to ensure software quality?

Question 59

All of the following are types of information systems general controls except:

A) application controls.
B) implementation controls.
C) physical hardware controls.
D) administrative controls.
E) data security controls.

Question 60

Malicious software programs referred to as malware include a variety of threats such as computer viruses, worms, and Trojan horses.

Question 61

Currently, the protocols used for secure information transfer over the Internet are:

A) TCP/IP, SSL and CA.
B) S-HTTP, TCP/IP, and CA.
C) HTTP, TLS, and TCP/IP.
D) SSL, TLS, and S-HTTP.
E) TLS, S-HTTP, and TCP/IP

Question 62

How does disaster recovery planning differ from business continuity planning?

Question 63

An authentication token:

A) is a device the size of a credit card that contains access permission data.
B) is a type of smart card.
C) is a device that displays passcodes.
D) is an electronic marker attached to a digital authorization file.
E) compares a person's unique characteristics against a stored profile of these characteristics to determine any differences between these characteristics and the stored profile.

Question 64

How can a firm's security policies contribute and relate to the six main business objectives? Give examples.

Question 65

Statements ranking information risks and identifying security goals are included in a(n):

A) security policy.
B) AUP.
C) risk assessment.
D) business impact analysis.
E) What-if analysis.

Question 66

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

A) Software
B) Administrative
C) Data security
D) Implementation
E) Authentication

Question 67

What is the role of an information systems audit?

Question 68

All of the following are currently being used as traits that can be profiled by biometric authentication except:

A) fingerprints.
B) facial characteristics.
C) body odor.
D) retinal images.
E) voice.

Question 69

Which of the following defines acceptable uses of a firm's information resources and computing equipment?

A) An information systems audit policy
B) A CA policy
C) A MSSP
D) A UTM system
E) An AUP

Question 70

Which of the following specifications replaced WEP with a stronger security standard that features changing encryption keys?

A) TLS
B) AUP
C) VPN
D) WPA2
E) S-HTTP

Question 71

You have just been hired as a security consultant by MegaMalls Inc., a national chain of retail malls, to make sure that the security of their information systems is up to par. Outline the steps you will take to achieve this.

Question 72

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key?

A) SSL
B) Symmetric key encryption
C) Public key encryption
D) Private key encryption
E) TLS

Question 73

Which of the following statements about passwords is not true?

A) Authentication cannot be established by the use of a password.
B) Password systems that are too rigorous may hinder employee productivity.
C) Passwords can be stolen through social engineering.
D) Passwords are often disregarded by employees.
E) Passwords can be sniffed when being transmitted over a network.

Question 74

How is the security of a firm's information system and data affected by its people, organization, and technology? Is the contribution of one of these dimensions any more important than the other? Why?

Question 75

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n):

A) security policy.
B) AUP.
C) risk assessment.
D) business impact analysis.
E) What-if analysis.

Question 76

An acceptable use policy defines the acceptable level of access to information assets for different users.

Question 77

A firewall allows the organization to:

A) enforce a security policy on data exchanged between its network and the Internet.
B) check the accuracy of all transactions between its network and the Internet.
C) create an enterprise system on the Internet.
D) check the content of all incoming and outgoing email messages.
E) authenticate users.

Question 78

Application controls:

A) can be classified as input controls, processing controls, and output controls.
B) govern the design, security, and use of computer programs.
C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.
D) include software controls, computer operations controls, and implementation controls.
E) govern the security of data files in general throughout the organization.

Question 79

________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors.

A) Stateful inspections
B) Intrusion detection systems
C) Application proxy filtering technologies
D) Packet filtering technologies
E) Firewalls

Question 80

Which of the following focuses primarily on the technical issues of keeping systems up and running?

A) Business continuity planning
B) Security policies
C) Disaster recovery planning
D) An AUP
E) An information systems audit